CVE-2026-66376Medium· 4.2▾ SunlitCredentials for a deleted user may remain valid for a short period under specific conditions.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.2%
Credentials for a deleted user may remain valid for a short period under specific conditions.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77519Medium· 5.4MaxKB is an open-source AI assistant for enterprise
CVE-2026-86473Critical· 9.1Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie
CVE-2026-92976Medium· 5.1A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite
CVE-2026-81637Low· 2.3Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthenticat…
CVE-2026-86533Critical· 9.1Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to remain fully authenticated. A resource configured with session_identifier :jti and require_token_p…
CVE-2026-92920Medium· 5.4admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions